HackingFinancial ServicesFinanceVulnerability ExploitCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDMediumContained

Hagerty Insurance Agency, LLC

bd_3020886c24aff5f1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 16, 2021

Filed

Mar 23, 2021

To disclose

5 weeks

Affected

27state residents only

Linked

6 filings

Confidence

66%

Full breach record for Hagerty Insurance Agency, LLC →2 incidents on file

Hagerty Insurance Agency, LLC notified the NH Attorney General of a cybersecurity event involving unauthorized access to consumer personal information via its public-facing 'Instant Quote' web feature. Automated bots exploited a vulnerability where personal data (including driver's license numbers) was embedded in webpage source code. The incident affected approximately 27 New Hampshire residents. Hagerty disabled the feature, implemented rate limiting and CAPTCHA, and engaged third-party security specialists for penetration testing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 5 weeks / 35 days

Feb 2, 2021

Begins

Feb 16, 2021

Discovered

Mar 23, 2021

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_b1562bb773105c262021-03-23Verified
Massachusetts State AGbd_bf71b6b8ded5d8042021-03-23Verified
Maine State AGbd_b16e684014a061292021-03-26 · +3dCandidate
Indiana State AGbd_40ca59323f999df62021-04-09 · +17dVerified

Show 1 more filing ↓up to 21d gap

Montana State AGbd_083cd91b97919bf72021-04-13 · +21dVerified by operator

Name: Hagerty Insurance Agency, LLC
norm: hagerty insurance agency

Name: Hagerty Insurance Agency, LLC
norm: hagerty insurance agency
Industry: Financial Servicesllm

Discovered: Feb 16, 2021
Breach occurred: Feb 2, 2021
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 9, 2021
Affected individuals: 27state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Submitted notice to New Hampshire Attorney General pursuant to N.H. RSA § 359-C:20
Initial access: exploit_public_facing

During the incident: Launched an internal investigation
Began blocking known IP addresses for the Bot(s)
Began using a rate limiter on its quote page
Began using a Captcha to stop Bot attacks
Turned off its Instant Quote feature to stop these attacks
Took all NY DFS-recommended steps to secure data outlined in the Fraud Alert
Restored its web quote page with rate limiting, reCAPTCHA, and with measures designed to preclude personal information from being accessible through the webpage source code
Engaged a third party security specialist to conduct a penetration test
Took back down its Instant Quote feature for further remediation and penetration testing
Continuing to prevent any additional information from being pulled from LexisNexis
Changes made: Implemented processes and protocols to mitigate this type of activity
Offering complimentary access to Experian IdentityWorks for 12 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGMar 23 · first

Massachusetts State AGMar 23 · first

New Hampshire State AGMar 23 · first · this page

Maine State AG+3d

Indiana State AG+17d

Montana State AG+21d

Pattern: first filing Mar 23 (CA), last Apr 13 (MT) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hagerty-insurance-20210323.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2021
Raw hash: e2b37351d831f059ee346fa5c136c299c7aef347c33f710e8b06f5a5fbaabb64

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityHagerty Insurance Agency, LLC

Victim entityHagerty Insurance Agency, LLC

Incidentdiscovered Feb 16, 2021

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov